Machine didn't reboot after cleaning

[kae]

Got a similar problem. After running AdwCleaner, it prompted me to reboot. My machine never came back up.  I'm trying to get it running again. Right now im running the windows repair diagnostic to fix startup problems.  It's not looking promising.

[kae]

Here are the logs.  Now to recover my system.

mbst-grab-results.zip

[jboursier]

Hello,

(I've split your messages from the original thread for clarity).

By any chance, would you still have the folder `C:\Windows\System32\Logfiles\` on your computer? If so, would it be possible to zip it and share it? (You can DM me if you prefer not to post its content in public).

It would hopefully help us a lot to track down what went wrong during the cleaning process..

Regards,

[kae]

I DM'd you the logfile zip.

The machine boots to a black screen.  I've had to go through a few gyrations to get it to go into recovery mode.  It will boot eventually, but doesn't seem to fully recover because each time I boot it goes through the same routine. When the machine finally boots and I login, It loops on a Windows Installer trying to run an install on a %Temp% file/folder that no longer exists.  Seems like it has something to do with this HP Photosmart printer that I have and the files that were removed. Some kind of digital image monitor that was removed by the removal software. I had an error with slack (loaded from the Windows Store) which I haven't seen since the first boot and then a problem with Adobe (which I don't think is related--I always have problems with Adobe). The only two things I remember that the AdwCleaner removed was a safe search PUP in Chrome and the HP digital image monitor. 

[jboursier]

Hello,

Thanks a lot for the logfiles, it will help and we'll get back shortly.

So to understand correctly the current situation: your computer is fixed, or still doesn't boot except by looping with the Windows Installer trying to install something?

[kae]

Back Story: Right after the AdwCleaner ran and rebooted, the machine would not boot at all (black screen). I tried to get it to boot, but nothing would happen, just the black screen. I finally got it to boot into recovery mode (using a USB drive with Windows 10 version 1903).  It was only after that recovery (which took several hours) that I could get the machine to boot at all.

Today: Right now the machine will boot eventually by itself, but it's not booting the way it was. So, I believe the computer still has problems booting.  It takes a long time to boot (like 20 minutes).  Before I ran AdwCleaner, it would boot in about a minute (it's a home built desktop running Windows 10 Pro with an SSD drive and 32GB memory)

I believe I have fixed the looping TrayApp.msi install problem by uninstalling all of the HP printer software.  After the uninstall finished, it had to reboot the machine. The machine hung during the reboot process and had to be reset (pressed the reset button on the case which is wired to the motherboard).  It took about 20 minutes to finish booting (most of that time was watching the circling dots).  After it booted and I logged in, it was no longer looping to try to install the TrayApp.msi.  I have a picture of the before screen when it was trying to install. When I hit cancel, the installer would have to timeout (a long time) and then when it popped up a new dialog saying that it failed, then it would start again to try to install looking for the TrayApp.msi file again.  In the picture below, I tried to look at the entire path, but I wasn't able to select the text in the "Use source:" textbox.  I also wasn't able to press the Browse... button.

Something is not quite right with the networking on the machine.  I noticed that I can no longer ping the machine.  It might be a setting that got flipped during the recovery.

I'm not sure why the boot is taking so long.  If I could figure that out, I'd feel a lot better about the sanity of the operating system.

Current Status: So, circling install is gone, now I just have booting slowness and maybe a network setting preventing ping.

If I can figure out why it's taking so long to boot and get that fixed. That would be good.

 

[Maurice Naggar]

Hello kae.

Some suggestions for your consideration.

Your pc runs Windows 10.   I would suggest you check and be sure that Windows 10 “fast startup” is OFF

https://www.tenforums.com/tutorials/4189-fast-startup-turn-off-windows-10-a.html

 

Next, suggest that ( at your next best opportunity) enable the F8 function key use at machine boot  ( that way you have means to have advanced startup options

See Option One at this article

https://www.tenforums.com/tutorials/22455-enable-disable-f8-advanced-boot-options-windows-10-a.html

 

Next, enable boot logging

https://winaero.com/blog/enable-boot-log-windows-10/

 

You may also have “verbose bootlogging”

https://support.microsoft.com/en-us/help/325376/how-to-enable-verbose-startup-shutdown-logon-and-logoff-status-message

 

Then shutdown and Restart Windows.

After that startup, you want to collect the boot log.

It will be located at %windir%    typically C:\windows    named NTBTLOG.txt

You can zip that file and then attach it in a reply.

 

 

 

[kae]

Here's the bootlog.  At least what I got.

ntbtlog.zip

[Maurice Naggar]

Thanks for the boot log.

The driver that is listed several times, as not loading is dxgkrnl.sys   which is a driver for DirectX Graphics Kernel from Microsoft Corporation.

[ 1 ]

In these next procedures using System File Checker, monitor the runs and keep notes.

This procedure will use the Windows System File Checker tool  ( SFC ).

 

Open an elevated command prompt window i.e. run Command Prompt as an administrator .

It is best to use the Windows Copy ( CTRL+ C )  and paste  ( CTRL+V )  for the whole line, as-is

To Get the elevated command prompt, press Windows-key + X key  and then selected Command prompt ( Admin )

On that command prompt,  Copy & Paste this command

sfc /verifyfile=C:\Windows\system32\drivers\dxgkrnl.sys

 

[ 2 ]

Do a new run for a global SFC run

sfc /scannow

[kae]

Here's what it showed:

The sfc /verifyfile=C:\Windows\system32\drivers\dxgkrnl.sys returned right away with

C:\WINDOWS\system32>sfc /verifyfile=C:\Windows\system32\drivers\dxgkrnl.sys


Windows Resource Protection did not find any integrity violations.

C:\WINDOWS\system32>

The sfc /scannow returned this:

C:\WINDOWS\system32>sfc /scannow

Beginning system scan.  This process will take some time.

Beginning verification phase of system scan.
Verification 100% complete.

Windows Resource Protection found corrupt files but was unable to fix some of them.
For online repairs, details are included in the CBS log file located at
windir\Logs\CBS\CBS.log. For example C:\Windows\Logs\CBS\CBS.log. For offline
repairs, details are included in the log file provided by the /OFFLOGFILE flag.

C:\WINDOWS\system32>

Here's the CBS.log CBS.zip

[Maurice Naggar]

Thanks for the information and log.

On your next reply, kindly let us know just which mode of Windows is in use at this point.

I have another suggestion for you, for the purpose of troubleshooting.

First, set Windows to enable the use of F8 function key at machine startup.   Use Option One & step 3

https://www.tenforums.com/tutorials/22455-enable-disable-f8-advanced-boot-options-windows-10-a.html

 

For troubleshooting, via a clean-boot startup

https://www.tenforums.com/tutorials/41804-perform-clean-boot-windows-10-troubleshoot-software-conflicts.html

 

This ought to help on your quest

Quote

figure out why it's taking so long to boot

 

[kae]

For which "mode" of Windows, do you mean Home, Pro, or Enterprise?  I'm using Windows 10 Professional Version 1903

I thought I would run a chkdsk on the C Drive so that it would check the Boot Drive and repair any damage just in case.  So, I scheduled a scan on the next boot using.

chkdsk C: /X /F

I figured out how long it takes to boot, it's a long time.

5:29PM Boot from Powered Off
5:41PM Shows MSI Logo (like the Boot Rom Logo)
5:45PM Shows Circling Dots below the MSI Logo
6:04PM Black Screen
6:13PM Boot Menu (showed "Windows 10", but no other options, The countdown expired before I did anything so it automatically went on)
6:18PM Shows MSI Logo with Circling Dots below
6:32PM Scanning & Repairing complete
6:32PM System is up and ready

Once the machine was up, I ran a DISM to fix the stored image.

DISM.exe /Online /Cleanup-image /Restorehealth

After the DISM finished, I re-ran the sfc command to fix the corrupted files that were reported

sfc /scannow

I believe I have the F8 function key setup so that it will work. I'm going to try the F8 on the next boot.  I'm also going to try the clean boot as well.

I'll let you know after the boot.  Thanks for helping.

[kae]

By the way, my C drive is a 1TB solid state drive

[Maurice Naggar]

By which mode, I mean:   Is it in Normal mode of Windows ?  or Safe mode ?  or Safe mode with Networking ?

 

On the startup, like  6:04PM Black Screen

Use your mouse and move it in a circular type fashion to see if screen refreshes.   You can also tap the Enter key on keyboard

Those types actions should get the process moving along.

 

IF you are seeing "" Scanning & Repairing complete ""  that tends to indicate something is needing attention about the Windows O.S. installation.

[kae]

I just ended up wiping the drive, reloading Windows and restored my data. That seemed to fix it.

[Maurice Naggar]

OK.   Thanks for the status news.  I am understanding that you have cleared the issue away via a new Windows install.

 

Best  practices & malware prevention:
Follow best practices when browsing the Internet, especially on opening links coming from untrusted sources.
First rule of internet safety: slow down & think before you "click".

Never click links without first hovering your mouse over the link and seeing if it is going to an odd address ( one that does not fit or is odd looking or has typos).

Free games & free programs are like "candy". We do not accept them from "strangers".

Never open attachments that come with unexpected ( out of the blue ) email no matter how enticing.
Never open attachments from the email itself. Do not double click in the email. Always Save first and then scan with antivirus program.
 

 

Pay close attention when installing 3rd-party programs. It is important that you pay attention to the license agreements and installation screens when installing anything off of the Internet. If an installation screen offers you Custom or Advanced installation options, it is a good idea to select these as they will typically disclose what other 3rd party software will also be installed.
Take great care in every stage of the process and every offer screen, and make sure you know what it is you're agreeing to before you click "Next".

Use a Standard user account rather than an administrator-rights account when "surfing" the web.
See more info on Corrine's SecurityGarden Blog http://securitygarden.blogspot.com/p/blog-page_7.html
Dont remove your current login. Just use the new Standard-user-level one for everyday use while on the internet.

 
Do a Windows Update.

Make certain that Automatic Updates is enabled.
https://support.microsoft.com/en-us/help/12373/windows-update-faq

Keep your system and programs up to date. Several programs release security updates on a regular basis to patch vulnerabilities. Keeping your software patched up prevents attackers from being able to exploit them to drop malware.

For other added tips, read "10 easy ways to prevent malware infection"

.

My best wishes to you.